AI News · Edition 32 ·
The Setting Nobody Checked
Mistral now trains on what users type unless they pay for the enterprise tier. The lesson isn't about one vendor — it's about defaults you never agreed to.
The one that matters
Mistral will train on what your staff type in — unless you are on the enterprise plan
Mistral, the French AI company whose models sit inside a growing number of European and Indian business tools, has changed a default. Text that users type into its products is now used to train its models. Enterprise-tier customers are exempt. Everybody else is opted in until they go and opt out.
That is the entire story. It is worth understanding precisely, because the useful part is not really about Mistral.
What this means for your business
Think about what your staff actually paste into a chat box on a normal Tuesday. At a 600-student school, the office manager pastes three parent complaint emails and asks for a polite reply — full names, class sections, sometimes a line about unpaid fees. At a 30-bed clinic, the front desk pastes a discharge summary and asks for a simpler version the family can follow. At a workshop with 40 staff, the owner pastes three supplier quotations to compare unit prices, then pastes the salary sheet to check a bonus calculation.
Not one of those people made a decision about data policy. They opened a cheap or free account, often a personal one on their own phone, and got the work done. The vendor's default setting decided everything after that.
The realistic exposure is not that a competitor types a question and receives your supplier quotation back. That is not how these systems work, and anyone telling you otherwise is selling something. The real issue is duller and harder to undo: text you never intended to publish has left your control and entered a training corpus you cannot inspect, audit or recall. For a clinic, that is a patient-confidentiality problem whether or not anything ever leaks. For a school holding records on minors, it is a question your management committee will eventually ask. Your obligations under Canadian privacy law, or under India's data protection rules, do not shift because a vendor changed a checkbox in a settings page.
What this is not
This is not a breach, a hack, or evidence that AI tools are unsafe to use. Your files are not becoming searchable. Most vendors, including this one, offer a business tier where training on your input does not happen — the safe configuration exists, it simply is not what you get by default.
Two groups will overstate this. Consultants will offer you a data-sovereignty audit for a fee that exceeds what you spend on the tools themselves. And vendors will pitch private or on-premise AI as the only responsible choice, when for most businesses a paid tier and a one-page rule about what never goes into a chat box does the same job for a fraction of the money.
What a sensible owner does this month
- List what your staff actually use, including personal accounts. Ask them directly; do not check the IT inventory, which will be wrong.
- Open the settings page of each tool and find the training or data-improvement toggle. Turn it off. This takes about ten minutes per tool.
- Write one page naming what must never be pasted anywhere: patient identifiers, student records, salary data, bank details, unsigned contracts.
- Pay for the business tier on the two or three tools that touch real customer data. The price varies by vendor, so check your invoice rather than a blog post.
- Put a reminder in the diary for six months out to check the same toggles again. Defaults change quietly, and this will not be the last time.
An afternoon of somebody's time, plus one or two tier upgrades. That is the whole response. Anyone quoting you a project should be asked what else they are including.
Also worth knowing
How this briefing is put together
Every morning we read the day’s AI announcements and reporting from the companies themselves and from the technology press, then pick the handful that actually change something for a working business. The analysis is ours and it is written for owners and managers, not engineers. Every story links to its original source — read them, and disagree with us where we’ve got it wrong.